🔍 Read the full analysis: France’s Claim Of Iranian Hacking In Supermarkets: What It Showed on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
France said on November 9 that an Iranian Revolutionary Guard Corps cyber unit called Shahid Kaveh carried out an October attack on refrigeration controllers at about 700 retail sites. French officials cited several technical and operational indicators; the attribution remains France’s claim, and Iran had not publicly responded by Monday evening, according to The Record.
The attack took place overnight on October 11–12, when refrigeration controllers at supermarkets were accessed remotely and their defrost settings changed to high temperatures. A report from France’s Cyber Crisis Coordination Centre, published through CERT-FR, says the changes caused major food losses and fires in at least 15 cases. The French foreign ministry says more than 700 retail sites were affected.
The Associated Press reported that temperatures reached 50 degrees Celsius for about six hours. It also reported that Intermarché alone estimated losses of tens of millions of euros in one day. The foreign ministry put total food losses at several tens of millions of euros. Those financial figures are attributed estimates, not a final audited tally.
France’s technical report describes several indicators behind the attribution: shared attack infrastructure, use of the FOFA internet-scanning tool, a propaganda outlet associated with Shahid Kaveh relaying the attack, and traces of Farsi. The Paris prosecutor’s office also cited IP addresses linked to devices in Iran, according to the AP. France summoned Iran’s ambassador and said it would propose new EU sanctions. Prosecutors have opened an investigation, which does not establish guilt.
France’s supermarket cyberattack claim What the evidence showed
France attributed an October attack on supermarket refrigeration systems to an Iranian cyber unit. The claim has business and diplomatic consequences, but it is not a court finding.
What happened to the stores
France says refrigeration controllers were accessed remotely overnight on October 11–12, 2026.
The affected equipment managed supermarket refrigeration.
France’s report says defrost settings were changed to high temperatures.
The report links the changes to major food losses and fires.
Why France made the attribution
Officials described a combination of technical and operational indicators, rather than one conclusive piece of evidence.
Shared attack resources
France said infrastructure used in the attack had also scanned Schneider Electric equipment.
FOFA scanning
The technical report cited use of the internet-scanning tool.
Propaganda channel
A channel associated with Shahid Kaveh relayed the attack, France said.
Farsi traces
French officials also reported traces of Farsi in the attack infrastructure.
Business exposure beyond data
The incident shows how connected equipment can affect stock, safety and operating costs—not just digital information.
- Food spoilage and major financial losses
- Fires linked to altered temperature settings
- Disruption to refrigeration and retail operations
- French authorities said management interfaces were exposed to the internet
- The precise access path has not been publicly established
- Equipment operators face risks beyond data theft
What happens next
The legal investigation and proposed EU sanctions are separate processes, and neither establishes responsibility by itself.
| Process | Current status | What remains open |
|---|---|---|
| Criminal investigation | Paris prosecutors opened a judicial investigation and are seeking international arrest warrants. | Allegations must be tested through legal proceedings. |
| EU sanctions | France says it will propose new sanctions. | Member-state discussions, measures and timing are not specified. |
| Iran’s response | No public response was reported by Monday evening. | A response remains pending. |
Supermarket Controls Exposed Online
The incident shows how a cyberattack on building and refrigeration equipment can cause physical damage and disrupt food retail without targeting checkout or payment systems. Changing a controller setting can spoil stock and, according to the French report, contribute to fires. The reported losses underline how operational technology can carry direct costs for businesses and consumers.
France’s cyber emergency team had warned in October that the affected controllers had management interfaces exposed to the internet, contrary to good practice. That detail points to a security weakness identified by French authorities, although the public material does not establish the full route the attackers used to gain access. Businesses that connect equipment used to manage temperature, buildings or industrial processes face risks beyond data theft.
The accusation also has diplomatic consequences. France’s planned push for new EU sanctions could turn a national incident into a wider policy dispute. The criminal investigation and any sanctions process will proceed on separate tracks, and neither is a substitute for a court-tested finding about who was responsible.
Products Worth Considering
LG UltraGear 32GX850A-B 32-inch 4K UHD OLED Gaming Monitor
LG UltraGear 27-inch QHD OLED Gaming Monitor, 240Hz
LG UltraGear 25G590B-B 25-Inch Full HD 1000Hz Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How France Built Its Attribution
France issued its attribution about four weeks after the attack. Three parts of the state presented information on November 9: the foreign ministry made the formal accusation, the cyber crisis centre published the technical account, and the Paris prosecutor announced a judicial investigation. The centre brings together France’s cybersecurity agency ANSSI, military cyber command, the defence procurement agency, and the DGSE and DGSI intelligence services.
The technical report does not point to one conclusive piece of evidence. It describes a combination of indicators. The report says infrastructure used during the attack was also used to scan Schneider Electric equipment at smaller energy and water facilities. It links the use of the FOFA scanning tool and the CyberbanNews propaganda channel to Shahid Kaveh, and says traces of Farsi were found in the attack infrastructure.
Foreign Minister Jean-Noël Barrot said at a G7 meeting in Paris, as quoted by AFP, that the attack was carried out by the IRGC. The foreign ministry described the incident as the first cyber-offensive campaign operated purely for sabotage purposes on French territory. That description is the government’s characterization. The same French report attributes other operations since 2020 to a different IRGC unit, Shahid Shoostari, including a 2023 attack on the Charlie Hebdo website and an attempted disruption of video displays during the 2024 Paris Olympics.
““I can confirm that this attack was carried out by the Islamic Revolutionary Guard Corps (IRGC) of the Islamic Republic of Iran.””
— French Foreign Minister Jean-Noël Barrot, quoted by AFP
Attribution Still Faces Legal Tests
The public evidence presented by France is a bundle of indicators, not a court ruling. The government has named a unit and its alleged parent organization, but the published material does not settle every question about how investigators linked the activity to specific individuals. An investigation is ongoing, and no conviction has been reported.
Iran had not publicly responded by Monday evening, according to The Record. The exact number of affected locations is also expressed differently in the source material: the cyber crisis report says about 700 retail sites, while the foreign ministry says more than 700. The final value of losses, the full extent of damage, and whether every fire was directly caused by the altered settings remain unclear from the material provided.
France’s warning about internet-exposed management interfaces identifies a security concern, but the available account does not detail the precise access path, whether other vulnerabilities were involved, or what additional safeguards have since been installed. Those details matter for judging how easily the incident could be repeated.
Sanctions and Investigation Ahead
France says it will propose new sanctions at the European Union level. Any measures would require further discussion among EU member states; the source material does not give a timetable or identify the proposed sanctions.
The Paris prosecutor’s investigation is seeking international arrest warrants for the alleged unit head and two deputies, according to the AP. The investigation may develop as authorities seek evidence and identify other possible participants. The allegations will remain unproven unless established through legal proceedings.
Further public updates may clarify the number of affected stores, the final financial losses, and what security changes retailers and equipment operators have made. For now, the confirmed development is France’s formal attribution and the steps it has announced; Iran’s response and the outcome of the legal and diplomatic processes remain pending.
Key Questions
What happened to the supermarket refrigeration systems?
France’s cyber crisis report says attackers changed defrost settings on refrigeration controllers overnight on October 11–12, 2026. The report links the changes to major food losses and at least 15 fires.
Who does France say was responsible?
France attributes the attack to Shahid Kaveh, a cyber unit it says is affiliated with Iran’s Islamic Revolutionary Guard Corps. This is the French government’s assessment, not a court determination.
What evidence did France publish?
The report cites shared infrastructure, use of the FOFA scanning tool, a propaganda channel that relayed the attack, and traces of Farsi. The Paris prosecutor’s office also cited IP addresses linked to devices in Iran, according to the AP.
How many sites and how much damage were reported?
The cyber crisis centre described about 700 affected retail sites; the foreign ministry said more than 700. The ministry estimated food losses at several tens of millions of euros, while the AP reported Intermarché’s estimate of tens of millions of euros in losses in one day.
What happens next?
France plans to propose new EU sanctions, and the Paris prosecutor is pursuing an investigation and seeking international arrest warrants for the alleged unit head and two deputies. The timing and outcome of those steps are not yet clear.
Source: ThorstenMeyerAI.com
